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SUMMARY 


The System Status Display study is part of the Advanced Transport Operating 
Systems program sponsored by the National Aeronautics and Space 
Administration's Langley Research Center and is directed toward the 
development of advanced display information for the flight deck operations of 
future commercial aircraft. The System Status Display (SSD) is an electronic 
display system which provides the crew with an enhanced capability for 
monitoring and managing the aircraft systems (i.e., hydraulics, electrical, 
etc.). The potential benefits to be gained through the use of electronic 
displays are improvement in crew performance, reduced probability of error, 
and more efficient workspace utilization. It is anticipated that these 
benefits in crew proficiency will significantly enhance the efficiency and 
safety of terminal area operations. 


INTRODUCTION 

The overall objective of the current study is to establish general principles 
and guidelines for the design of electronic system displays. The technical 
approach to this problem involves the application of system engineering to the 
design of candidate displays and the evaluation of alternative concepts by 
part-task simulation. This report covers the system engineering portion of 
the study and the selection of candidate displays. 

The study identifies display information requirements based on detailed 
analysis of representative flight operations. This analysis includes the 
development of a sequential iterative model of the crew functions involved in 
the operation of the aircraft systems. This model is used to develop a task 
flow diagram identifying all the crew decisions and actions necessary to 
manage and monitor the aircraft systems. The information requirements for 
each of these tasks are identified by review of the system operation, mission 
requirements and flight phase requirements. The information requirements are 
partitioned into four distinct classes: 


i 



IDENTIFIERS. The name or label of an item such as a switch legend. 

DESCRIPTORS. Information regarding the elements of a system and 
their functional and spatial relationships similar to those that 
might appear in a systems description manual. 

SYSTEMS STATUS. The operational state of the system including 
parameter values such as hydraulic pressure. 

INSTRUCTIONS. The operational procedure necessary to establish or 
modify the system configuration such as the checklist. 

This classification scheme aids in the identification of information sources 
(e.g., system sensors, procedures manual, etc.) and the selection of specific 
display formats based on knowledge of human information processing and human 
engineering design criteria. 

The selection of alternative display configurations is based upon existing 
knowledge of human memory coding strategies and memory structure. The basic 
principle is that the fewer cognitive processing steps required by the crew, 
the quicker the response and the less chance for errors. In general, 
comprehension of information regarding the relationships among the system 
components and dynamics of system operation is facilitated when the 
information is presented in a format that is compatible with a pictorial or 
"iconic" memory code. It may also be hypothesized that information regarding ' 
a set of actions that are performed serially (e.g., a well defined procedure) 
can be comprehended more readily when presented in an ordered text format. 

Since the System Status Display must perform both functions, optimization of 
the individual display format requires a full understanding of crew 
information requirements and how the information will be used within the 
context of the intended mission. In order to achieve the desired level of 
display-operator compatibility, three alternative display formats were 
mechanized for experimental test: pictorial only, printed word lists, and 

pictorial information with printed word instructions. 
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The proposed system consists of a display generator, a matrix display, and 
control and sensor interfaces. The flight hardware would be redundant and 
would be interfaced with other display components, i.e., the primary flight 
and the flight management displays. For the simulation, a high resolution 
three-color shadow mask CRT was used as the matrix display. 

In general a display by exception philosophy is used. According to this 
philosophy, information is presented only if it is required in order for the 
crew to perform the required task or to inform the crew that the system status 
or the operational envelope of the aircraft has changed. The crew has the 
option of calling up more detailed status information at any time. 

A summary page is presented as the baseline format for all flight phases 
unless the crew calls up a systems page. The summary page contains 
alphanumeric alerts and selected system parameters that are relevant to the 
particular phase of flight. A dedicated control panel may be used to call up 
a systems page. The first systems page presents the status of the system. 
Additional pages contain more detailed information and may be called up by the 
advance page key. The first line of the systems page (see Figure 9 for 
example) contains identification of the system and alerts if any exist. The 
next three lines are reserved for procedures. The remainder of the display 
contains the pictograph or the printed word formats. Established display 
design guidelines based on human engineering and graphic design principles 
were used to generate the display formats. Alternative display formats were 
generated for the fuel, hydraulics, and the flight control systems. 




BACKGROUND 


Advances in digital electronics and CRT technology add new dimensions to 
cockpit designs. These advances allow increased versatility in the crew 
interface design and the assignment of crew roles in flight and system 
management functions. The major portion of the crew tasks in aircraft systems 
management involve monitoring system status and detecting system faults. Our 
present knowledge of human capabilities and limitations indicates that routine 
monitoring functions can be performed more efficiently and reliably by 
automatic devices. The inherent capability of contemporary electronic 
equipment will allow the designer to allocate many of these functions to 
automated elements of the system. The crew will then be able to devote more 
attention to primary duties of decision making and flight management. 

Increased automation offers the potential for reducing the crew workload. 

This is counteracted to some degree by a trend toward increasing system 
complexity, a reduction in crew size, and constraints on workspace layout. 
These factors tend to modify traditional crew roles and duties. The 
proportion of time devoted to systems management tasks has increased 
substantially while manual control task demands have decreased. Instead of 
manually operating the aircraft, the crew performs primarily analytical 
functions. This change in crew roles has raised some flight safety issues. 

In a review article on the role of the crew and automation in flight, Weiner 
and Curry (1980) identified several issues that have a potential impact on 
flight safety. The primary concerns expressed by Weiner and Curry were the 
failure of the crew to recognize and respond to failures of automatic 
equipment, and the loss, or lack, of learned skills to perform in a manual 
backup mode. 

Over the last six years. Rouse (1981) has investigated the role of automation 
in aircraft applications. As a result of his research studies and the 
recognition of the safety issues, he proposes the following: 
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1. An adaptive automation wherein under normal conditions, the crew performs 
manual operations and, as the workload increases, automation is used to 
assist the crew. This allows the crew to maintain their skill level and 
have the advantages of automation when it is necessary. 

2. As an aid to problem solving tasks, the computer is used to prompt the 
crew, i.e., the computer assists the crew by tracking crew actions and 
telling the crew the implications of their actions. Rouse's empirical 

studies have found that this type of assistance reduces the number of 
human errors. 

The traditional duties of the crew in the management of aircraft systems 
include operational switching of system hardware, on-line monitoring of system 
status for faults or changes in the system, and reconfi guration of the 
aircraft system when a fault is recognized. Current cormiercial aircraft have 
substantial automation and redundancy at the system level as opposed to the 
display level. The crew interface is composed of hardwired, dedicated 
electromechanical displays and controls. Fault detection logic and 
annuciation are built into most aircraft systems. These fault annuciations 
are simple out-pf-tolerance detectors and are hardwired to an annunciator 
light, an aural alarm, or a voice warning device. Current aircraft have a 
large number of annunciators and the simple logic contributes to a large 
number of false alarms. These false alarms have been a major concern of 
pilots and system designers (Cooper, 1977 and Randle et al., 1980). Recently, 
the Federal Aviation Administration has been supporting an effort to arrive at 
design standards for a commercial transport aircraft's cockpit alerting and 
warning system (Boucek et al., 1981). These standards include priority and 
inhibit logic for presenting warning, cautionary, and advisory alerts. 

The concept of a computer aided, multifunction system management display first 
appeared in the early 1970 's. Bauerschmidt and La Porte (1976) suggested that 
it was the advent of CRT displays and digital processors that allowed the 
concept of a multifunction display to become a reality for status monitoring. 
They reported that such a display has many potential advantages including 

improved reaction time, decreased error rate, and a simplified hardware 
interface. 
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The use of a CRT system monitoring display and a digital computer was 
incorporated into a study performed by Hughes Aircraft Company for the Air 
Force (Streeter et al., 1973). This display presented functional status 
values, caution and warning annunciations, mode advisories, and checklists. 

The hardware consisted of a single CRT with multifunction switches whose 
functions were indexed by legends on the CRT display, and a digital display 
processor. The page formats of the CRT were printed word lists and the 
structure of the page varied according to the nature of the fault. Evaluation 
of the concept was not reported. 

Boeing Aircraft Company performed a study for the Air Force with the objective 
of identifying requirements for multifunction displays in military cockpits 
(Graham and Broomhead, 1975). This study identified the following 
requirements but did not provide any supporting data for the requirements: 

1. Graphic displays have limited utility and are not required in a 
multifunction display. 

2. When graphic interaction is required, a cursor control is more effective 
than a light pen or a touch panel. 

3. Multifunction switches should be programmed by peripheral equipment and 
be capable of changing modes automatically. 

4. Functional data or parameter values should be displayed. 

5. A system should be designed to provide maximum utility and minimum 
workload. 

In a study conducted by the Air Force (Bateman et al . , 1980) multi legend 
switches, CRT indexed switches, and CRT page formats tailored to a specific 
fault versus a branching logic were evaluated empirically. The first page of 
the format with the branching logic provided a summary of the system and 
subsequent pages provided more detailed status. The results of this 
evaluation showed that response times and errors were less for the multilegend 
switches and the tailored logic was superior to the branching logic. 
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McGee and Harper (1980) described a status monitoring system for a rotary wing 
aircraft. This concept used a single CRT display to present status, 
procedures, and parameter values. Dedicated switches were used for CRT page 
call up and systems control. The CRT formats were printed word lists for 
status and procedures, and bargraphs for parameter values. The design concept 
was not evaluated. 

A forerunner of the current project at Douglas Aircraft was an engine 
monitoring and display system, EMADS (Mas et al . , 1979)., EMADS is an 
integrated engine management system composed of a CRT display, a dedicated 
control panel, and a display processor. The display formats contain 
structured tables of status information and bargraphs of engine parameters. 

The display provides engine alerts and procedures for correcting the alerts, 
thrust commands and limits, trend information, and checklists for prestart 
procedures and flight planning. The EMADS display system was recently 
evaluated against conventional instrumentation in performance of normal and 
emergency operations (Po-Chedley, 1981). The results of this evaluation 
showed that pilot performance with EMADS was better or the same as that 
obtained with conventional instruments. Subjective evaluations by operational 
pilots were favorable towards EMADS. 

Current operational aircraft with multifunction system monitoring displays 
include the McDonnell Douglas F-18 and the Airbus Industries A310. The F-18 
has a monochromatic CRT display and uses indexing keys for menu and mode 
selection. Index keys are located: on the CRT's edge with the key's legend on 
the CRT. System status switching is performed by dedicated switches and the 
CRT page formats are printed word lists of status, procedures, and parameter 
values. Limited graphics are available. The A310 is the first airliner to 
incorporate a multifunction status monitor. This unit is called the 
Electronic Centralized Aircraft Monitor (ECAM) and it is redundant to the 
dedicated instruments contained in the center and overhead panel. The ECAM 
consists of two high resolution color CRT displays located in the center 
instrument panel and a dedicated switch panel located on the pedestal. 

Dedicated system switches are located in the overhead panel. The left CRT 
pages contain printed word fault annunciations, status lists, and procedures. 
The right CRT contains schematics, graphics and/or numeric displays of 
parameter values. 
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It is apparent that there are advantages to multifunction system status 
displays and they will be incorporated into future aircraft. The primary 
advantages of computer driven displays are to aid the crew in the detection 
and recognition tasks, to provide prompting, decision aids, and flexible 
display formats. Although previous studies provide some design guidance, 
there are a number of design alternatives and issues that need to be 
addressed. Key questions to be answered may be summarized as follows: 

1. What is the role of the crew in reconfiguring redundant systems? Should 
his role only be as a passive monitor of an automated system or should he 
participate actively in reconfiguring the system? 

2. Depending on his role, what information should be presented to the crew? 
What system engineering methodology should be applied for specifying the 
information requirements? 

3. What format should be used for displaying the information to the crew? 

4. What control interface devices should be used? Should dedicated controls 
be used or is it possible to integrate the control interface with the 
displayed information? 

The approach used in answering these questions included the development of a 
candidate system concept, the utilization of system analysis techniques to 
identify the information requirements, and the selection of candidate 
display/control formats and hardware based upon the technology that will be 
available for the next generation aircraft. The intent is to evaluate the 
alternative configurations using part-task simulation. 
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DEFINITION OF THE SYSTEM STATUS DISPLAY CHARACTERISTICS 

The first step towards the development of a candidate concept was to review 
the various approaches to aircraft systems management and to identify the 
basic hardware configuration for the SSD. This was accomplished by surveying 
system designers and flight operations personnel regarding system management 
and display/control philosophy. 

INDUSTRY SURVEY 

Initially, an in-house committee composed of flight operations personnel, 
design engineers, and human factors engineers held a series of meetings to 
discuss the issues involved and arrive at a preliminary system concept. 
Subsequently, a detailed questionnaire was distributed to system design 
engineers and flight operations personnel to solicit their opinions on the 
design issues. The results of this questionnaire are summarized in Appendix 
A. This questionnaire was revised and it formed the basis for a structured 
interview with the research and developement personnel from three other 
airframe manufacturers: McDonnell Aircraft, St. Louis; Lockheed, Georgia; and 
Boeing, Seattle. These interviews solicited opinions on the design issues and 
approaches to system management displays. The questionnaire and the responses 
to the interview are contained in Appendix B. 

SYSTEM DESCRIPTION 

As" a result of these surveys, the following system concept was formulated: 

The SSD serves as a crew interface for all systems except the flight guidance, 
flight management, and the radio management systems. The latter systems have 
separate crew interfaces. The SSD consists of dually redundant computers and 
CRT displays (or flat panel matrix displays). The SSD computer receives data 
from and sends data to the peripheral aircraft systems, the flight guidance 
computer, the flight management computer, and the caution and warning system. 
The SSD computer drives the CRT displays and receives crew inputs via 
multifunction switches. A conceptual block diagram of the system is shown in 
Figure 1. In addition, there are dedicated, hardwired displays and controls 
for backup or when electrical power is not available. 
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FIGURE 1. CONCEPTUAL SYSTEMS ARCHITECTURE FOR THE SYSTEMS STATUS DISPLAY 


The general display design philosophy is display by exception. That is, the 
mode of operation for both normal and abnormal conditions is to present only 
the information necessary to inform the crew of changes in the operational 
envelope of the aircraft and to reconfigure the system. However, detailed 
status information is made available to the crew upon demand. 

The following features and capabilities are prime candidates for incorporation 
into the SSD. 
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DISPLAY FLEXIBILITY. Computer generated displays allow flexibility in the 
display content and format. The display formats are standardized and are 
designed to improve the crew's ability to interpret and use the information. 

It is anticipated that this flexibility will increase the efficiency of crew 

operations, i.e., reduce the response time and reduce the number of crew 
errors. 

INFORMATION STORAGE AND PRESENTATION. Crew procedures and system descriptions 
are stored in the computer and displayed in formats that are compatible with 
the presentation of status information. The computer is used to monitor the 
crew actions and prompt the crew for the next action or alert the crew if an 
incorrect action is performed. The system provides feedback to the crew 
regarding the results of their actions and annunciates changes in aircraft 
status or operating restrictions. 

FAULT DETECTION AND PRIORITIZATION. Fault monitoring and detection occur 
within the peripheral systems. Prioritization of faults and flight phase 
inhibit logic occur within the SSD computer or a separate caution and warning 
system. The fault system uses the guidelines set forth by the FAA Aircraft 
Alerting Systems standardization study (Boucek, et al., 1981). Higher order 
monitoring, i.e., interpretation of fault conditions when multiple failures 
occur and the analysis of trends are considered desirable characteristics to 
be incorporated into the fault monitoring logic. 

ALLOCATION OF FUNCTIONS BETWEEN THE CREW AND AUTOMATED EQUIPMENT. The level 
of automation of the system is the responsibility of the individual system 
designer. As a rule, the system should operate in a hands off mode (i.e., it 
should be designed with a minimum amount of monitoring and control required). 
System redundancy should provide a fail operational capability (i.e., there 
should be automatic switching between redundant systems). In general, the 
crew should only become involved in a systems operation if the operational 
capability of the aircraft or the mission is affected. 
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INFORMATION REQUIREMENT ANALYSIS 


Within the conceptual framework defined above, the definition of the display 
content was based on a thorough analysis of crew information requirements. 

This approach consisted of a task analysis, identification of required 
information, an operational sequence analysis, and classification of the 
information. The study was initiated by reviewing the normal and abnormal 
procedures for two current commercial aircraft: The MD-80 and the DC-10-30. 

This review resulted in the decision to perform an in depth analysis of two 
systems and to develop the guidelines and representative formats for these two 
systems. The two systems selected were the fuel and the hydraulic systems. 

The selection of these systems was based upon their relevance to safety during 
the critical phases of flight (i.e., a hydraulic failure impacts the flight 
controls and a fuel failure could affect the range, gross weight, and balance 
of the ai rcraft) . 

The candidate designs for the fuel and the hydraulic systems used in this 
study are likely candidates for a next generation, two engine, two man crew, 
commercial aircraft. The designs are based upon DC-10 technology with 
multiple levels of redundancy and include automated features anticipated by 
system designers. Descriptions and block diagrams of these two systems are 
presented in Appendix C. 

Task flow diagrams were generated for the two systems. A generic example is 
shown in Figure 2. These diagrams were generated by using a sequential, 
iterative model to describe the crew-system operations. 

According to this model, the process of managing the aircraft systems involves 
periodic review of system status. Elements of this monitoring function are 
performed automatically and the outcome of the status check will determine 
what actions (if any) are taken. The general flow contains three basic steps: 

1. Check to determine if the system configuration is nominal and, if not, 
reconfigure the system. 

2. Check to determine if the actual configuration agrees with command 
configuration. 
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3. Check the status to determine if the system is operating properly and, if 
not, a contingency procedure is entered. 

The remainder of the task flow is designed to accommodate variations in 
information requirements as a function of flight phase and to access 
information required for entering the next flight phase. 



FIGURE 2. GENERIC TASK FLOW DIAGRAM 
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The task flow shows only the decisions and actions required to complete an 
operation. The next step in the analysis is to identify the information 
required to make the decisions and/or to perform the actions. The information 
requirements were identified by reviewing each element in the flow diagram in 
terms of specific input parameters required, the pilot's knowledge of the 
system, and operating procedures for necessary control of the system. 
Subsequent to the information requirements analysis an operational sequence 
analysis was generated to identify the sequence of steps for collecting the 
information and performing the necessary decisions and actions. 


For both the fuel and hydraulic systems, two procedures were analyzed: the 

normal operating procedure and one contingency. The fuel contingency was a 
tank imbalance advisory and the hydraulic contingency was a dual hydraulic 
failure resulting in partial failure of the flight controls. These three 
analyses: the task analysis, the information requirement analysis, and the 
operational sequence analysis are presented for both systems in Appendix D. 

To assist the development of display formats, the information was classified 
according to the way in which the information is used by the crew. This 
classification scheme aids in the identification of display alternatives and 
application of human engineering principles to determine the optimum format. 
The information requirements were partitioned into the following four basic 
classes: 

1. IDENTIFIERS. The name or label of an item. The source may be either a 
legend or the crew's memory. 

2. DESCRIPTORS. Information regarding the elements of a system and their 
functional/spatial relationships. The source is either the crew's 
memory, the systems description manual, or aircraft instrumentation. 

3. SYSTEM STATUS. The operational state of a system including any parameter 
values. The source is the system sensors and aircraft instrumentation. 

4. INSTRUCTIONS. The operational procedure necessary to establish or modify 
the system configuration. The source is the checklist, the crew 
procedures manual, the crew's memory, or aircraft instrumentation. 
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DISPLAY ANALYSIS 


Options for displaying information in current aircraft are limited to a large 
extent by the inflexibility of conventional display media. Switches are 
labeled by printed alphanumerics, parameter values are displayed by 
electromechanical instruments (i.e. pointer dials, vertical tapes, or 
numerical readouts) and descriptive and procedural information is presented in 
manuals using a combination of printed words and pictorial formats. Recently, 
there has been an attempt to layout the components on the control panels 
according to their functional/spatial relationships in the aircraft. 

The utilization of digital computers for the processing and storage of 
information increases the flexibility of presenting information to the crew 
and offers the potential for enhancement of the crew interface. Given the 
numerous alternatives for display formats, the problem of identifying the 
format which the crew is able to comprehend and utilize most effectively 
becomes critically important. 

The approach to addressing these issues was to first review the display and 
control hardware alternatives and to select the most viable alternatives for 
empirical evaluation. The second step was to review established human 
engineering and graphic design principles to arrive at a set of guidelines for 
the SSD display formats and to apply these guidelines in the development of 
alternative formats for empirical evaluation. 

DISPLAY AND CONTROL ALTERNATIVES 


The last decade has produced major advances in flight deck technology. One of 
the most significant ones is the replacement of the electromechanical displays 
with computer-generated imagery on CRT displays. This has allowed the 
tailoring of display formats to be compatible with the crew's ability to 
interpret the information and to use multiple formats on a reduced number of 
display surfaces. The advances in the control interfaces have been somewhat 
slower. Current commercial transports use dedicated control panels with few 
exceptions. However, there are several multifunction control alternatives 
which could be incorporated within the next decade. 
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Display Technology 


Contemporary electronic display technology employs high brightness, high 
resolution, three color shadow mask CRT's for primary flight and status 
displays. These displays have been incorporated into the cockpits of Boeing 
Aircraft Company's 757 and 767 aircraft and the Airbus Industries A310 
aircraft. The attributes of these displays include the following: 

1. High brightness which provides readable contrast at ambient illumination 
levels of 8000 foot candles. 

2. High resolution with a minimum resolvable element of .010 to .012 inches. 

3. Full color capability using the three primary colors. Although the 
current units only provide a limited number of fixed colors (i.e., 
approximately 15) they have the potential for producing a full color 
spectrum. 

4. Versatile image generation using hybrid image generation techniques with 
both stroke writing and raster fill capabilities* 

Flat panel technology has the potential for offering considerable savings in 
power consumption and space. Although significant developments have been made 
in liquid crystal matrix displays and thin film electroluminescence panels 
(Brindle et al., 1980, Knuta, 1981, and Uede, 1981) further advances are 
required before they achieve the capability and the reliability of the CRT 
displays. The three-color shadow mask CRT display is considered the most 
viable alternative for the next decade. 

Control Technology 

Recently, controls have advanced from toggle and rotary switches to pushbutton 
switches with backlighted legends. Commercial transport aircraft use 
dedicated controls (i.e., each control knob or switch has a one and only one 
function). The only non-dedicated switches have been CRT indexed switches and 



keyboard data entry panels on the RNAV and flight management control units. 

CRT indexed switches are pushbutton switches located on the edge of the CRT 
with the switch legends located on the CRT. These multifunction switches are 
used more commonly in advanced military aircraft. 

Other approaches incl ude mul til egend switches, touch panels, and voice 
recognition data entry devices. The only commercially available multilegend 
switches are projection switches using individual incandescent bulbs for each 
readout. No commercial aircraft use these switches due to their relatively 
poor legibility at high levels of ambient illumination. Other alternatives 
are LCD, LED, or thin film electroluminescence alphanumeric matrices on the 
switch head. Development of these switches require advances in the state of 
the art but they could be available for the next generation aircraft. Touch 
sensitive panels are transparent overlays on the CRT display wherein a switch 
is activated by touching a specified area on the display. Feedback is 
provided by an audible tone and/or a visual change on the CRT display. 

Several technologies have been used for touch panels and include pressure 
sensitive panels, electrostatic panels, and LED-photocell arrays. It should 
only be a matter of time before one of these alternatives become technically 
feasible. Voice recognition devices are in early development (Mountford and 
North, 1980) and still require technological advances before they become 
operationally feasible. 

There have been empirical evaluations of CRT indexed switches and multilegend 
switches (Bateman et al., 1980). It was found that both response time and 
error were lower with multilegend switches than the CRT indexed switches. 

This may be attributed to the legend appearing in a different location than 
the switch with the CRT index approach. Touch panels have been criticized for 
their lack of tactile feedback (Graham and Broomhead, 1975). There has not 
been any empirical evaluation of touch panels without tactile feedback or 
using other forms of feedback. 

IMAGE PRESENTATION CONCEPTS 

In reviewing relevant literature, it was found that inadequacies exist in the 
present guidelines for design of CRT display formats. Pictures, schematics, 
word messages or some combination of the above have been proposed. Available 
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data indicate pictures are better than words in communication of information’ 
regarding objects and their spatial/functional relationships and tend to 
facilitate association learning. Words appear clearer in meaning, are 
considered essential for presentation of abstract concepts, and are regarded 
by developmental psychologists as important in the formation of logical, 
sequential operations. 

A partial explanation of these differences is supported by research in human 
memory coding. Pictorial information is believed to be stored in a direct 
memory code which bears a close relationship to the sensory experience that 
gave rise to it (Haber, 1970). Words are stored in phoneme (speech 
utterances) codes or by the visual presentation of the phonemes (written 
language). To relate the phoneme code to the visual sensory experience 
requires a transition from the visual image to the spoken language and then to 
the phoneme code. These operations require additional mental processing steps 
when compared to direct storage of a visual image. 

Two relevant studies have evaluated printed versus pictorial formats. Booher 
(1975) compared six picture word formats for instructions: print only, 

pictorial only, and four combinations of print and pictorial. The four 
combinations included: (1) primarily pictorial information with short verbal 

statements for the actions required, (2) primarily verbal information with 
pictures for object identification, (3) primarily pictorial information with 
redundant words, and (4) primarily verbal information with redundant 
pictures. The results of this study showed pictorial information is important 
for speed but word information is necessary for accuracy. Comprehension of 
instructions was most efficient with a combination consisting of primarily 
pictorial information with short verbal statements for the actions. In 
another study by Tull is (1981), four different CRT formats were evaluated: a 

narrative printed format, a structural tabular format, a black and white 
schematic, and a color schematic. The results showed that response times were 
consistently faster for both of the schematic formats while accuracy did not 
vary between the formats. 

The shorter response times support the concept that retention of pictorial 
information requires fewer mental processing steps than words. Based upon 
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this theory, pictorial imagery should be used as much as possible. However, 
this depends upon the type of information to be transmitted. Nominal 
information, i.e., information known through the senses rather than intuition 
and thought, should be pictorially displayed since it has a direct visual 
code. Noumenal information, i.e., information conceived by reason, does not 
have a visual image and must be coded in a graphic or a verbal language. 

It can be hypothesized that identifications, descriptions, and status 
information are best presented in pictorial imagery or a combination of 
pictorial and al phanumerics. Instructions which do not have a direct visual 
imagery could be presented as or more effectively with words. If mental 
imagery is required for interpretation, instructions will require more 
processing steps than pictures. However, a highly structured sequence of 
operations might be performed quite easily with printed instructions. 

Human memory studies have demonstrated that abstract and symbolic information 
is stored in long-term memory by different structures (Posner, 1970). The 
simplest form of structure is a list. More complex structures exist including 
matrices where the dimensions of the matrices represent different attributes, 
e.g., a branching or hierarchical structure. One complex structure is the 
physical layout of the system in the aircraft. Symbolic diagrams showing the 
functional relationship of components or schematics is an example of another 
type of structure. Another structure would be a procedural sequence or a task 
flow diagram. 

Based upon the above review, it appears that the best method of presentation 
would be a pictorial diagram of the system with printed instructions. In 
order to evaluate the above concept, it is proposed to test the hypothesis 
that significant differences in crew performance would be found between the 

following conditions: pictorial without instructions, pictorial with printed 

instructions, and alphanumerics consisting of printed word lists and printed 
instructions. Table 1 shows the three experimental conditions and the 
comparisons that would be made by the evaluation. The display page formats 
are described in detail in a latter section of this report. 
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TABLE 1 

ALTERNATIVE DISPLAY CONCEPTS AND COMPARISONS FOR 
THE EXPERIMENTAL EVALUATION 


ALTERNATIVE FORMAT CONCEPTS 


CONCEPT 

FUNCTION 

description 

INSTRUCTION 

1 

PICTORIAL 

NONE 

2 

PICTORIAL 

ALPHANUMERIC 

3 

alphanumeric 

ALPHANUMERIC 


EXPERIMENTAL COMPARISONS 


CONCEPT COMPARISONS 

INFERENCE 

1 AND 2 

DO SUPPLEMENTARY WRITTEN INSTRUCTIONS 
IMPROVE PERFORMANCE WITH A PICTORIAL FORMAT? 

1 AND 3 

WHAT IS THE RELATIVE EFFECTIVENESS OF 
PICTORIAL AND ALPHANUMERIC FORMATS? 

2 AND 3 

CAN DESCRIPTIVE INFORMATION BE PRESENTED 
• MORE EFFECTIVELY WITH A PICTORIAL 
REPRESENTATION? 


DISPLAY FORMAT GUIDELINES 

As a result of the above analysis and the utilization of standard principles 
for human engineering design (Semple et al., 1979 and Krebs et al., 1978) and 
graphic design (Morse, 1979 and Marcus, 1980), the following guidelines were 
established for the development of the display formats. 

General Guidelines 

1. Labels, status, and system descriptions are coded by shape or identified 
by alphanumerics. 

2. Printed action verbs are used for instructions and the object of the 
action is identified by a symbol or a word. 
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3. Color is used to indicate the operating status of a system. Five colors 
are used: 

a. White for the identification and system description. 

b. Green for indicating normal status or normal operation. 

c. Blue for advisory status. 

d. Amber for caution status or to indicate a partial failure. 

e. Red for a warning status or to indicate a total failure. 

The brightness contrast of the five colors will be adjusted so that they 
are nearly equal. The colors will be displayed against a black 
background. 

4. A1 phanumerics are of uniform intensity. One size is used for the majority 
of the information. A larger size is used only to identify the system. 

The size will be based upon the eye design reference point and will be 
large enough to provide 100 percent recognition of color symbols. 

Capital letters will be used and the font style will be sans serif. 

5. In general, a display by exception design philosophy will be applied and 
only information necessary to perform the required action will be 
displayed. In some cases, this philosophy may be modified in order to 
avoid unnecessarily frequent or distracting changes to the display 
formats. 

6. The crew will have the option to call up additional, more detailed 
information. This information will be added to the simpler uncluttered 
display by using an overlay. 

7. Disagreements between the command status and the actual status of a 
system will be sensed and displayed as a fault. 

8. Both graphics and text should be presented as simple as possible without 
degrading the content. There should be geometric separation of 
functional groups on a display page with empty spaces in between to 
increase the legibility of display elements. 
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Pictorial Format Guidelines 


1. Pictographs wi ll be used, to represent system components and their 
functional arrangement. A representative set of pictographs are 
presented in Figure 3. 


FUEL TANKS, RESERVOIRS 
• FILL SHOWS RELATIVE 
QUANTITY 

•COLOR OF FILL SHOWS 
STATUS 


ELECTRICAL 

SWITCH 



MANIFOLDS 

• FILL SHOWS FLOW 

• COLOR OF FILL SHOWS 
STATUS 


r 


ELECTRICAL BUS 

• FILL SHOWS CURRENT 
FLOW 

• COLOR OF FILL SHOWS 
STATUS 


VALVES 


OFF rtTDc 


ON 



PUMPS 

• BACKGROUND FILL 
INDICATES STATUS 


OF, 


ON 



TEMPERATURE GAUGE 

• FILL SHOWS RELATIVE 
TEMPERATURE 

• COLOR OF FILL SHOWS 
STATUS 


PRESSURE GAUGE 

• FILL SHOWS RELATIVE 
PRESSURE 

• COLOR OF FILL SHOWS 
STATUS 



AMMETER 

• FILL SHOWS RELATIVE 
CURRENT 

• COLOR OF FILL SHOWS 
STATUS 



FIGURE 3. PICTOGRAPHIC SYMBOLS USED IN THE PICTORIAL DISPLAY FORMATS 


2. Connecting lines in the pictograph represent fuel manifolds, hydraulic 
manifolds, pneumatic lines, and electrical connections. Solid color fill 
of these lines indicated the operational state of these lines: empty if 
the system is off, green if it is operating normally, blue if there is an 
advisory, amber if there is a failure causing a caution status and red if 
there is a failure causing a warning status. 
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3. Pictographs representing reservoirs are color filled. The amount of fill 
represents the quantity within the reservoir and the color represents the 
operational state. 

4. Pictographs representing parameter values, i.e., temperature gauges, 
pressure gauges, ammeters, etc., are color filled to facilitate 
quantitative reading relative to scale values. The color represents the 
operational state. Accurate quantitative readouts are provided by 
numerics where required. 

5. The structure of the pictorial display is a schematic which represents a 
combination of the physical location and the functional relationships of 
the system and their elements within the aircraft. The general 
hypotheses is that a pictorial schematic presents the least abstract 
visual image of a system and it should require the least amount of mental 
processing to store the image or recognize changes in the image. 

Printed Word Format Guidelines 

1. Noun phrases are used to label or identify a system component. 

2. Adjective phrases are used to describe the status of a system component. 
Numerics are used to provide quantitative parameter values. If interval 
or ordinal scale information is required, a bar graph is used. 

3. As in the schematic system components are grouped according to their 
physical as well as functional relationships. This word structure 
provides the only information which relates to system description. 

Printed Instructions 

; !• Action verbs represent a single action or a sequence of activities. 

2. The object of the action is designated by an arrow in the pictorial 
format and by a word descriptor preceding the action verb in the word 
format. 
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SYSTEM STATUS DISPLAY EVALUATION 


A part- task simulation study should be utilized to further evaluate the 
alternative display concepts and the control configurations. The part-task 
simulation would be performed in a fixed base cockpit simulator and would be 
designed to test the ability of representative sample of pilots to operate the 
aircraft systems under normal and emergency conditions with primary emphasis 
on correcting system failures. 

The experimental design would be a factorial experiment with the three 
alternative display formats tested in combination with the three alternative 
control configurations. Repeated measures would be used on a sample of ten to 
twelve pilots. A full factorial design would be used to test for interactions 
between the display and the control alternatives. Training on the respective 
display/ control configuration would be provided prior to initiation of the 
experimental trials. 

» 

Although the system is designed for a normal two-man crew configuration, the 
experiment will test the ability of one crew member to fly the aircraft arid 
perform the system functions. This will represent a hypothetical worst case 
condition when a crew member is lost. The test conductor will occupy the 
right hand seat to provide instructions and observe. 

An experimental run would consist of the pilot flying a straight in approach 
pattern to decision height using the flight director guidance mode. Random 
disturbances, simulating wind gusts would be used to establish the desired 
level of workload on the flight task. During the approach, single or multiple 
faults of the fuel and/or the hydraulic systems would be introduced. The 
pilot would be required to detect the fault via the master caution and warning 
system and correct the fault via the SSD while maintaining flight path 
control. All events would be recorded on a timeline. 

The dependent performance measures would be the response time and the response 
accuracy in correcting the fault. Flight task performance would be measured 
by the flight path and speed deviations from the desired values. A two-way 
statistical analysis would be used to determine significant differences 
between the treatment conditions. The treatment alternatives would be ranked 
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on the basis of producing the least number of errors while having a minimum 
effect upon flight task performance. In addition, the pilots would be asked 
to subjectively rate the different alternatives. The correlation between the 
subjective rankings and the objective performance measures would be evaluated. 

SYSTEM STATUS. DISPLAY SIMULATOR 

In order to demonstrate and evaluate the alternative configurations a 
part-task simulator was developed. This simulator uses a fixed base cockpit 
with computer driven displays and a terrain model system for outside visual 
reference. The equations of motion, the DC-10 aerodynamics and control system 
models, and simplified models of two engines, the fuel system, the hydraulic 
system, and the SSD formats are provided by a Digital Equipment Corporation 
Virtual Address Extension (VAX 11/780) computer. This is linked to a.- ..,o:;Vv 

satellite computer that interfaces the controls, the cockpit and the visual' 
reference terrain model - systemV" .Tfife" cockpit, l-ayorut- a'nd- instrumentation is a 
moc *’ ^ Thd ^S^SD .displray is a 6-inch ARINC size C, high brightness CRT 
located in the lower left corner of the center console that is normally 
occupied by the standby flight instruments. The remainder of the 
instrumentation is provided by the DC-10 electromechanical instruments. 

The SSD display is driven by a Vector General graphics display generator. 

This generator is a calligraphic system and allows real-time programming of 
animated graphics. The format instructions are provided by the host computer. 

The SSD has a dedicated control panel in the top left corner of the forward 
pedestal which is normally occupied by the RNAV control display unit. The SSD 
control panel uses backl it pushbutton switches and a separate key is used for 
each system. A system may have more than one page which can be called by 
advance page or back page keys. 

The switches for controlling the fuel and the hydraulic systems are provided 
in three alternative configurations: 
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1. A dedicated panel located in the forward pedestal and aft of the SSD 
control panel. This contains backlighted pushbutton switches. Each 
system function has a dedicated switch. 

2. A multifunction switch panel in place of the dedicated switch panel in 
the forward pedestal. This panel contains multilegend pushbutton 
switches using projection switch technology. The function of the 
switches is controlled by the SSD panel. The switches will display the 
legends and control the system that is selected upon the SSD panel. 

3. A touch panel overlaying the SSD CRT. This panel uses a pressure 
sensitive membrane. A system function may be changed by touching the 
symbol or word identifier for the component. An audible tone provides 
feedback that a switch has been activated and the component's operational 
state will change on the display. 

The location of the SSD display and the control panels are shown in Figure 4. 
Any differences in performance between the touch panel and the other two 
configurations could be attributed to the following factors: 

1. Separate locations for the system display and the control switch panels 
versus the same location with the touch panel. 

2. Differences in spatial location and reach between the switch panels and 
the touch panel. 

3. Differences in sensory feedback between the switch panels and the touch 
panel . 


Outline drawings of the SSD control panel and the dedicated fuel and 
hydraulics control panels are shown in Figures 5 and 6, respectively. The 
multifunction control panel contains a 3 by 5 array of switches. This array 
has either the legends for the fuel or hydraulic system as shown in Figure 7, 
depending on which system has been selected. 
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FIGURE 4. FIXED BASE COCKPIT SIMULATOR WITH THE SYSTEMS STATUS DISPLAY 
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AC/PNEU 


ELEC 


FLT CON 





ADV 

PAGE 








FIRE 

PROTECT 


FUEL 


HYD 



B 








ICE /RAIN 


POWER 

PLANT 


WATER/ 

WASTE 



SUMMARY 


SCROLL 








FIGURE 5. SYSTEMS STATUS DISPLAY CONTROL PANEL 


CRT FORMATS 

The CRT page structure consists of summary pages and system pages. The 
summary pages contain the alerts and status information pertinent to the phase 
of flight. The system pages contain fault indications and status information 
related to a specific system. 

Summary Page 

The summary page contains a prioritized and sequentially ordered list of 
alerts requiring the crew's attention. Printed words instead of pictographs 
were used for this page since the fault list represents a highly structured 
sequence of recommended actions. 
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FIGURE 6. DEDICATED CONTROL PANEL FOR THE HYDRAULIC AND FUEL SYSTEMS 
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MULTIFUNCTION CONTROL PANEL 


TK 1 
FL VAL 
AUTO 


■ 


1 






TK 1 
FWD PMP 
ON 


AUX TK 
FWD PMP 
ON 


TK 2 
FWD PMP 
ON 






TK 1 
AFT PMP 
OFF 


AUX TK 
AFT PMP 
OFF 


TK 2 
AFT PMP 
OFF 






X-FEEO 

CLOSED 


Hg) 






FUEL SYSTEM 
CONFIGURATION 


HYDRAULIC SYSTEM 
CONFIGURTION 


MULTIFUNCTION CONTROL PANEL 


HYD 1 
El PMP 
ON 


HYD 2 
E2 PMP 
ON 


— “I 

HYD 3 
E2 PMP 
ON 






HYD 1 
AUX PMP 
OFF 


HYD 2 
El PMP 
ARM 


HYD 3 
AUX PMP 
OFF 








1-3 REV 







OFF 


















FIGURE 7. ALTERNATE CONFIGURATIONS FOR THE MULTILEGEND CONTROL PANEL 
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A candidate display page is shown in Figure 8. The first line on the page is 
used to identify it as the summary page and the page number out of the total 
number of summary pages is presented in the right-hand corner. The first page 
of the summary is the nominal display or default condition. However, it may 
be called up at any time by the summary page key on the SSD control panel. 

The left-hand portion of the page is dedicated to alerts. There is one alert 
message per row. The message identifies the system, the component within the 
system, and the fault. Within a priority category items are listed 
chronologically with the most recent item at the top of the category. 



SUMMARY cruise 


r “| 


JHYD SY1 OFF | 

FUEL REMAINING 

iHYD SYZ LO PRESS 


I FUEL TK1 LO PRESSi 

CABIN AIR 

|a/c Pkl OFF j 

wmmm. 

1 1 

CABIN ALTITUDE 

i i 

■ i 

r mmm. 

i ! 

! 1 

L_ 1 



LEGEND: 


RED 


1 YELLOW 



GREEN 


; BLUE 


FIGURE 8. FORMAT FOR THE SUMMARY STATUS PAGE 
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The example shows two font sizes: the larger size is used for page 

identification and the smaller size is used for the remainder of the 
information. The larger font subtends a visual angle of 26 minutes with a 4 
by 3 aspect ratio and a stroke width of 3.2 minutes. The smaller font 
subtends a 20 minute visual angle, the same aspect ratio, and a stroke width 
of 1.6 minutes. This allows 19 rows of fault messages to appear on one page. 
If there are more than nineteen faults at one time, the lower priority faults 
appear on a second page. 

The right side of the page provides a summary list of checklist procedures to 
be performed during the flight phase. Once these procedures are completed 
this information is erased and the remaining information is system parameters 
which the crew monitors as necessary throughout a flight phase. The example 
shown in Figure 8 represents the cruise phase of flight. 


Systems Page 


There /.is ^a - . 'set of ' System pages for each aircraft system. These are selected 
by the system keys on the SSD control panel. The system pages have a summary 
page and additional pages with more detailed information. There are three 
alternative formats of each system page for the experimental evaluation. 


A typical pictograph page with procedures is presented in Figure 9 and the 
word list in Figure 10. The first row is used to identify the system and its 
status. Printed words are used for this identification in order to provide a 
brief and concise status summary. The first words identify the system, the 
second words identify the system status which are color coded, and the page 
number out of the total number of pages is presented in the right-hand 
corner. The next three rows contain word procedures except for the 
pictograph-only format (in which case this area remains blank). For the 
pictorial format with word instructions, an arrow is used to identify the 
object of an instruction. For the word listing, the object is identified by a 
printed word prior to the instruction, for example, PUMP 1-OFF. The remainder 
of the status page contains the pictograph of the system or a structured list. 
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FIGURE 9. PICTORIAL FORMAT FOR THE FUEL SYSTEMS PAGE 


FUEL ENG START 
TK2 FWD PUMP-ON 


111 


TANK 1 


AUX TANK 


TANK 2 

'/A 


FILL VALVE FILL VALVE FILL VALVE 

sb mi warn 

FWD PUMP FWD PUMP FWD PUMP 




AFT PUMP AFT PUMP AFT PUMP 


X-FEED VALVE 


X-FEED VALVE 


LEGEND: 

RED 

H YELLOW 
GREEN 


BLUE 


FIGURE 10. ALPHANUMERIC FORMAT FOR THE FUEL SYSTEMS PAGE 
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The information analyses of the fuel and hydraulic systems identified two 
pages for the fuel system and three pages for the hydraulic system. The first 
page of each system provides summary information on the status and can be used 
to reconfigure the system. The second page of each system provides detailed 
parameter information and it may be called up at the option of the crew. In 

addition, a flight control surface page may be called up for the hydraulic 

\ 

system since the status of the control surfaces is directly affected by the 
hydraulic system status. 

SYSTEM OPERATION AND PROCEDURES 

For normal procedures the SSD provides status information and procedures 
according to the phase of flight. Each page identifies the systems that 
require checkout. The crew calls up the system page and proceeds through the 
checklist presented on the systems page. Upon completion of a system, the 
crew proceeds to the next system in the sequence until all the procedures are 
completed. For abnormal procedures, the fault is annunciated by the master 
caution and warning system and displayed upon the summary status page. The 
crew selects the systems page to reconfigure the system and determine if there 
are any changes in the operational limits of the aircraft. 

Normal Procedures 

When electrical power is turned on, the prestart summary page is displayed 
upon the SSD. The right-hand portion of the page contains the prestart 
checks. The crew proceeds to the first system and goes through the 
procedures. Only three checklist items appear on a page at one time. If the 

system can acknowledge completion of the procedure, it will automatically 
scroll the list. Otherwise the crew will be required to depress the scroll 
key. The crew receives feedback on the completion of a procedure by a change 
of status on the display. If there is a disparity between the crew action and 
the system status, a disagree fault is annunciated. The systems page remains 
on until the crew selects the next page or there is a change in the flight 
phase (in which case it will default to the summary page). Upon the 
completion of a checklist, the checklist is erased by depressing the scroll 
key. The next flight phase summary page may be brought up by selecting the 
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flight phase advance key or it may occur automatically when certain flight 
conditions are met (e.g., V speeds, landing gear retract, etc.). 

Abnormal Procedures 

When a fault occurs, it is annunciated on the master caution and warning 
system and on the summary status page. The crew member may cancel and reset 
the master caution and/or warning annunciator at his discretion but the fault 
will remain on the summary page until it is corrected. Once it is corrected, 
it is erased from the list. To correct a fault the crew member depresses the 
system key to bring up the systems page. The systems page identifies the 
location and the nature of the fault and presents correction procedures. The 
crew member reconfigures the system using these procedures. 

Through activation of a backup component, the fault message is deleted and the 
failed component is identified on the systems page only. If the system cannot 
be reconfigured, the fault remains annunciated and the crew reviews the effect 
it has on the operational state of the aircraft. This is accomplished by 
depressing the advance key which will show any change in the operational state 
of the aircraft. 

The following example is used to illustrate the operation of the system. 
Suppose at time T1 an external leak occurs in Hydraulic System 2 which results 
in loss of pressure. This results in a caution annunciation on the master 
status page. The first page of the hydraulic system shows loss of fluid in 
the reservoir and the manifold is filled in amber with the engine pump on (see 
Figure 11). The procedure is to turn off the engine pump and return to the 
summary page which now shows system one off. The crew may elect to review the 
flight control system, but this is optional with the loss of only one 
hydraulic system. Now, suppose that at time'T2, the number two engine pump 
fails on system two. The system should automatically switch on the number one 
engine pump but fails to do so. With the loss of pressure in two hydraulic 
systems, a warning indication occurs and the two failures are shown in red on 
the summary page. The hydraulic page shows the manifold of systems 1 and 2 in 
red. The instructions are to turn on the number one engine pump. Figure 12 
shows the first hydraulic systems page with the instructions and Figure 13 
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FIGURE 11. HYDRAULIC SYSTEMS PAGE WITH A FAILURE IN SYSTEM 1 



FIGURE 12. HYDRAULIC SYSTEMS PAGE WITH A DUAL HYDRAULIC FAILURE 









FIGURE 13. SECOND HYDRAULIC SYSTEMS PAGE WITH A DUAL FAILURE SHOWING DETAILED 
STATUS INFORMATION 


shows the second page with the detailed status information that the crew has 
the option of selecting. If the pump turns on, the manifold turns green 
indicating normal operation and the alert reverts back to a caution 
indication. 

If the engine pump does not turn on, the crew advances through the pages to or 
calls up the flight control page. As shown in Figure 14, this page shows the 
status of the control surfaces in color code where red indicates a failed 
system, amber a partially failed system, and green a fully operational 
system. In addition, it shows the actual slat and flap position and indicates 
the operating speeds for the current configuration. The word list alternative 
is a listing of the surfaces and their status as shown in Figure 15. 
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LEGEND: 


RED 

WIHm YELLOW 

Iili GREEN 

BLUE 


FIGURE 14. PICTORIAL FORMAT FOR THE FLIGHT CONTROL PAGE WITH A DUAL- 
HYDRAULIC FAILURE 


LEGEND: 
I-I-I-I-I- RED 
l | YELLOW 
GREEN 


BLUE 


FIGURE 15. ALPHANUMERIC FORMAT FOR THE FLIGHT CONTROL PAGE WITH DUAL 
HYDRAULIC FAILURE 


CON SYi- 
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RUDDER 

UPR INOP 


LG TRIM 

RATE REDUCED 


FLAPS 

INOP 

0 DEG 

SLATS 

MAY NOT FULLY EXT 

RET 

SPOILERS 

1,2. 4. 5 INOP 
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SYI INOP 


REVERSERS 
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NSE GR STR 

L INOP 
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CON u 1 

V MIN - 150 KTS 
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DISCUSSION 


The results of this study have provided useful insights and guidelines for the 
design of status displays for aircraft systems. However, there remain a large 
number of unanswered questions on display formats that will require empirical 
evaluation and further analysis before a comprehensive set of display 
guidelines can be presented. 

Although it is not a new concept, the systems engineering approach used to 
identify and classify the information requirements for the various aircraft 
systems according to flight phase is a viable approach and it is recommended 
for future design applications. The approach identifies information based 
upon the crew's need for the information in order to make a decision or 
perform an action. The analysis classifies the information according to type, 
(e.g., identifiers, descriptors, parameter values, and instructions). This 
.classification is useful in determining how the information should be 
presented and the sizing of display pages. Although the information selection 
was based upon the criticality of the information, no further attempt was made 
to prioritize it or classify it according to priority. This would require 
analysis of all the aircraft systems on a timeline and knowledge of their 
interactions which was beyond the scope of this study. 

Another key issue is the role of the crew in systems management and how much 
automation should be introduced. Analysis did not resolve this question nor 
will the proposed simulation study provide an answer. To resolve this 
question requires a larger effort including a comparative analysis of the 
alternate designs in a longitudinal study (i.e., data collection over a 
significant period of the operational lifetime of the aircraft) to evaluate 
the reliabilities of the alternatives. In the interim, there are some rules 
that can be followed: 

1. Automation should be used to achieve an optimum level of crew workload 
(i.e., to avoid overload or underload). 

2. The allocation of functions should provide for an adequate level of 
operator involvement in order to facilitate reversion to manual modes of 
operation in the event of an automatic system failure. 
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3. Information provided to the crew should generally be limited to those 
parameters that are necessary for performance of required crew duties 
(with optional crew callup of additional information). 

4. For those functions requiring operator awareness or action, the 
recommendations stated in this report provide a basis for deciding 
between design alternatives. 

The flexibility of computer- generated display formats allow the designer to 
design display formats that are appropriate for a given level of automation 
and compatible with crew capabilities and limitations. A number of guidelines 
for formatting the displays based upon human engineering and graphic design 
principles have been presented. However, the effectiveness of a particular 
format depends on the type of operation and conditions of use. Pictorial 
formats based upon the functional/spatial relationships of a system have an 
intuitive appeal and there is evidence in the literature to support the 
concept that fewer mental steps are required to interpret pictorial 
information. On the other hand, abstraction and higher order thought 
processes do not necessarily have any relevant pictorial imagery and such 
information must be presented by some other coding method such as a verbal 
language. The optimum approach may be a combination of pictorial information 
for identification, description, and status and alphanumeric information for 
instructions. A part-task simulation study would be valuable to further 
evaluate pictorial information versus verbal information and should provide 
insight into the best format for specific system display applications. 
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APPENDIX A 
IN-HOUSE SURVEY 

Douglas Aircraft design engineers and flight operations personnel were 
surveyed to obtain their opinions of current system status displays and what 
they think should be incorporated into the next generation aircraft. Twelve 
design engineers and six pilots responded to the survey. A summary of the 
relevant results is presented below. 

ADEQUACY OF CURRENT AIRCRAFT STATUS INFORMATION. Except for selected design 
deficiencies, the majority of the design engineers felt they were adequate as 
presently implemented. The pilots thought that too much data and extraneous 
data were presented. 

ADEQUACY OF NORMAL AND ABNORMAL PROCEDURES. Some design engineers thought 
that the procedures were time consuming and did not think they were always 
followed. The majority of the design engineers thought they were adequate. 

The pilots stated that too much time was spent on troubleshooting. They 
suggested simplicity and redundancy are required in order to improve crew 
operations. 

IMPROVEMENTS THAT COULD BE MADE IN NEXT GENERATION AIRCRAFT. Design engineers 
stated that automatic fault monitoring and reconfiguration should be 
incorporated. The majority felt that fail-safe operations should be part of 
the basic systems design and failures should be annuciated with minimum false 
alarms. Pilots agree with automated switching of redundant systems and 
fail-safe operation and to display only the limitations that are imposed on 
the operation of the aircraft. 

RATING OF THE DIFFERENT FEATURES OF A MANAGEMENT SYSTEM. The respondents were 
asked to rate different features of a system management system on their 
desirability and their feasibility. The consensus of each group is presented 
in Table Al. The results are presented as a positive (+), an indifferent (0) 
or a negative (-) attitude towards a feature. 
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TABLE A1 

ATTITUDE OF RESPONDING PERSONNEL TO FEATURES OF A MANAGEMENT SYSTEM 


FEATURE 

DESIRABILITY 

FEASIBILITY 

ENG 

FLT OPS 

ENG 

FLT OPS 

PROCEDURES 

+ 

+ 

+ 

0 

PROMPTING 

+ 

+ 

0 


AUTOCONFIGURATION 

0 

+ 

+ 

_ 

ALERTS 

+ 

+ 

+ 

0 

TREND ANALYSIS 

+ 

+ 


0 

FAULT DIAGNOSIS 

- 

0 

+ 

0 
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APPENDIX B 

AIRCRAFT MANUFACTURERS SURVEY 


Representatives of three airframe manufacturers were interviewed. These 
interviews were conducted in order to take advantage of previous experience in 
the development of system management displays, and from the advanced concepts 
being developed for NASA Langley. Three companies were interviewed: 

McDonnell Aircraft, St. Louis, who has developed the F-l 8 aircraft, Lockheed 
Aircraft, Georgia, who is developing the advanced crew station for NASA 
Langley, and Boeing Aircraft, Seattle, who is developing the Functional 
Requirements for a Multifunction Flight Management Control/display Unit. 

McDonnell Aircraft used an iterative design and development cycle for the F-18 
cockpit. The requirements, displays, and display formats were developed by a 
steering committee. The prototype designs were evaluated by simulation 
wherein both objective and subjective measures were used. The design process 
was reiterated depending on the results of the simulation. The aircraft uses 
multifunction displays and status information is provided by printed word 
lists. Control of the displays is by multifunction switches which are located 
on the perimeter of the CRT's and indexed by the CRT's. 

Lockheed Aircraft is developing an advanced cockpit by a research team 
composed of system designers, pilots, and human factor engineers. Basically 
the same approach is being used at McDonnell's, the group develops the 
concepts and it is evaluated and refined by simulation. The station is a 
two-man desk top console with six split image CRT displays and side stick 
controllers. A combination of pictorial and printed word formats will be 
used. Other data entry devices will be via keyboards and touch panels. 

Boeing Aircraft is developing an advanced flight management control display 
unit. Their approach is to review existing units, review the operational and 
information requirements, and develop a design concept using hardware 
components that are available for the next generation aircraft. The basic 
design consists of a flat panel alphanumeric display and a multilegend 
keyboard. Page selection is via branching logic. 

The survey questions and the responses are presented in Table B1 
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TABLE B1 

RESULTS OF THE AIRCRAFT MANUFACTURERS' SURVEY 


QUEST ION 

MCDONNELL AIRCRAFT 

LOCKHEED AIRCRAFT 

BOEING AIRCRAFT 

1) Current cockpit design philosophy 
is leaning towards the quieT cocKpIt 
concept cr display by exception. This 
would mean that the system status 
information would be displayed when a 
fault occurs or If the crew Is 
required to reconfigure the system 
during any portion of the mission. Do 
you agree with this philosophy? 

Justify your response. 

Display by exception was the basic 
design philosophy used for the F-1 8 
design. One problem with il Is the 
requirement to present trend 
Information. We had to provide the 
pilot with predictive cues in the 
flight director display. 

Display by exception is the basic 
philosophy. Contingencies come up 
automatically. However, the crew 
has the ability to erase and 
recall. 

Display by exception is the basic 
philosophy, however, the crew will 
still want status Information 
according to fl Ight phase and 
workload conditions. 

2) The display by exception philosophy 
requires the aircraft designer to be 
able to Identity all probable 
contingencies prior to their 

“---"ce-ce. Do you believe •‘■his is 
r:i£ ; rfe? Justify vour response. 

We used an interactive approach 
using simulation and flight test to 
identity those requirements which 
were not predicted. 

Over time an iterative approach 
will Identify all contingencies. 

The Identification of all 
contingencies is prohibitive. The 
designer needs to Identify the 
major ones which are known to be 
critical to the operation of the 
aircraft. 

3) An alternative to the display by 
exception concept is to provide 
comprehensive Information to the crew. • 
Is this a viable alternative? 

Alternative display formats are 
displayed upon demand. Both 
formats are Incorporated irto the 
design. 

The crew needs the ability to call 
up a system upon demand. The 
system will alert the crew to - 
redundant failure (fall safe) and 
the crew will have the option to 
Inhibit the alert or call up a 
deta lied dl spl ay. 

Different levels of detail should 
be provided upon crew demand In 
addition to the display by 
exception. 

4) Advanced aircraft designs are using 
multiformat crt displays for system 
status information. Do you believe 
all status Information should be 
presented on multifunction displays, 
or should dedicated displays be used 
for all or part of the Information? 
Justify your response. 

Displays requiring near or 
continuous lookup should be 
dedicated. In the F-1 8 these were 
the engine and Inertial navigation 
displays. 

Dedicated displays are required for 
emergency power conditions. These 
Include engine, APU, 
pressurization. Ice/rain 
protection, and exterior 1 Ights. 

Except for A Ft) start and with 
proper redundancy, dedicated 
displays are not necessary. Time 
or flight critical conditions would 
be candidates for dedicated 
displays. 

5> One advantage of current avionics 
technology is the prol Iteration of 
digital computers. Computers can aid 
the crew In performing a variety of 
tasks. Evaluate the destrabil Ity and 
the feasibility of the following 
computational aids for both normal and 
abnorma 1 procedures. 




Information Storage. Menus, 
checklists, and performance data may 
be stored, updated, and displayed by 
fl Ight phase or upon demand. 

Yes, checklists should be provided. 

Yes, checklists should be provided. 

Checklists are desirable. There 
are developmental problems to 
overcome. 



TABLE B1 

RESULTS OF THE AIRCRAFT MANUFACTURERS' SURVEY (Continued) 


QUESTION 


Prompting. Switch position and 
opera+Ionnal status of the system may 
be sensed and, with the aid of 
computer logic, prompting cues may be 
displayed to assist the crew. 

Prioritization and Inhibition of 
Faults. Logic trees may be used to 
prioritize faults according to 
criticality or Inhibit the fault 
according to the flight phase. 


Trend Analysis. The rate of change of 
critical parameter values may be 
sensed and If they exceed threshold 
The change In the parameter value Is 
annunciated to the crew. 


Autoswitching, The logic not only 
detects a failure but It checks the 
overral I status of a system and 
reconfigures It. 


Fault Diagnosis. The logic performs 
test routines to detect and annunciate 
equipment malfunctions. 


MCDONNELL AIRCRAFT 


It would be desirable for critical 
systems but difficult to Implement. 


A combination of sense modalities 
were used. Voice alerts were 
I Imited to the six most critical 
warnings. Aural alerts were used 
for nine to ten warnings. The 
master caution and warning 
annunciator and visual 
annunciations were used for all 
alerts. 


We were backed Into trend analysis 
and It was not by design. 

Parameters were arrived at by the 
steering committee. Thresholds and 
parameter values were selected by 
simulation evaluation. 

The F-1 8 cockpit was automated as 
much as possible and status 
Information Is presented to the 
pilot only If ft is f I fght 
critical, for the fall safe 
systems. The crew Is notified only 
If there Is a change In the 
operational envelope. 


Diagnostics should only be provided 
It it has an effect upon the 
mission performance. 


LOCKHEED AIRCRAFT 
No response. 


The FAA Alert Standardization Study 
guidelines are being Incorporated 
Into the design. 


Basically we agree with trend 
analysis but do not understand how 
to Implement It. 


A fall operational system would not 
require the crew to Interact. 
However, the crew should be 
Informed of the failure. 


Messages should only be presented 
It the operational limits of the 
aircraft are affected. 


BOEING AIRCRAFT 

If the display system Is designed 
correctly prompting Is not 
necessary. It defeats the concept 
of a quiet cockpit. 


The results of the FAA's Alert 
Standardization Study are being 
applied. 


It depends on the role of the crew. 
If his role Is a controller, trend 
Information adds a compl Ication 
that is unnecessary. If he Is a 
ft tght manager, you want to provide 
him with trend Information. 

The design should allow manual 
overr I de. 


Diagnostics should not be fncluded. 





APPENDIX C 

SYSTEM DESCRIPTION OF FUEL AND HYDRAULICS SYSTEM 

The fuel and hydraulic systems are representative of an advanced two engine 
two-man crew coimercial air carrier. The systems described utilize current 
technology. Extensive automation was not incorporated in order to have 
examples with a large number of crew interactions. 

FUEL SYSTEM 


The fuel supply consists of two main tanks, an auxiliary tank, and two pumps 
in each tank. A fuel manifold, crossfeed valves, fill valves, and associated 
controls permit total crossfeed and transfer capability. Fuel from the 
auxiliary tank is transferred normally to the main tanks through the fuel 
manifold and the respective tank fill valves. The main tanks have float 
sensors that turn the fill valve on and off automatically if the auxiliary 
tank pumps are on and the fill valve is armed. Each pump has a pressure 
sensor that turns on an annunciator when the pump pressure exceeds 5 psi. If 
a fill valve sticks in the open position, resulting in an overfill of the main 
tank, the overfill is annunciated. If there is a fuel imbalance (i.e., there 
i s an imbalance of more than 900 kg between the main tanks) it is 
annunciated. Pump control and the crossfeed valves are operated manually. A 
schematic of the fuel system is presented in Figure Cl. 


TANK 1 *UX TANK TANK 2 

l 1 r n 



LEGEND 

E) CHECK VALVE 
(J) PUMP 
o SHUTOFF VALVE 
FLOAT VALVE 
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HYDRAULIC SYSTEM 


The hydraulic system consists of three parallel, continuously pressurized 
systems. System one is powered by a left engine driven pump and an auxiliary 
electrical pump. System two is normally powered by a right engine driven 
pump. With loss of pressure in the system, the left engine pump is 
automatically turned on. System three is powered by a right engine pump, an 
electrical auxiliary pump, and a ram air turbine. The ram air turbine is 
automatically deployed during flight if there is loss of hydraulic pressure in 
system three. In addition, a reversible motor pump will transfer power 
between systems one and three if more than a 400 psi differential in pressure 
exists between the two systems. If there is a loss of quantity in either 
reservoir of systems one and three, the motor pump will shut down. The 
electrical pumps are used for ground operations but may also be used for 
emergency operations in case the other power sources fail. A schematic of the 
hydraulic system is shown in Figure C2. 

All three hydraulic systems are isolated from each other so that the loss of 
one system will not effect the operation of the other systems. Attachment of 
the hydraulic sensors to the control surfaces are the same as the DC-10 
aircraft with the exception of the following: the engine thrust reversers are 

hydraulically driven and both the upper and lower portions of the rudder have 
dually redundant actuators. The connections are designed so that the aircraft 
remains fully operational with the loss of one hydraulic system and the 
primary flight surfaces remain operable if only one hydraulic system is 
f unctioni ng. 
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FIGURE C2. HYDRAULIC SYSTEM BLOCK DIAGRAM 












APPENDIX D 

TASK AND INFORMATION REQUIREMENT ANALYSES FOR 
THE FUEL AND THE HYDRAULIC SYSTEMS 


For each of the systems described in Appendix C, analyses were performed of 
the normal procedures and one contingency. These analyses included the 
following: 

1. TASK FLOW ANALYSIS. This included all decisions and actions required by 
the crew according to a sequential, iterative model. This model is 
iterated from mission initiation until it is either completed or aborted. 

2. INFORMATION REQUIREMENTS ANALYSIS. For each task listed in the task flow 
analysis the information required to complete a task is identified for 
each phase of fl ight. 

3. OPERATIONAL SEQUENCE ANALYSIS. This is a sequence of tasks (both the 
crew and automated tasks) required to collect the information and perform 
the decision and action tasks. A subsequent analysis was performed for 
only the crew's tasks. 

4. INFORMATION CLASSIFICATION. After each information requirement is 
identified it is classified according to the type (e.g., identifier, 
descriptor, status, or instruction), the type of scale used for 
presenting the information, and the source of the information. 

The task and information requirement analyses are presented for the normal 
procedures of both systems in Figure D1 and D3. Analyses are also presented 
for an imbalance contingency of the fuel system in Figure D2 and a dual 
hydraulic system in Figure D4. The operational sequence analysis and the 
information classification are presented in Figures D5 to D8. 
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FIGURE D1. INFORMATION REQUIREMENT ANALYSIS FOR THE FUEL SYSTEM'S NORMAL PROCEDURES (Continued) 





FIGURE D2. INFORMATION REQUIREMENT ANALYSIS FOR THE FUEL SYSTEM'S TANK IMBALANCE PROCEDURES 
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FIGURE D3. INFORMATION REQUIREMENT ANALYSIS FOR THE HYDRAULIC SYSTEM'S NORMAL PROCEDURES (Continued) 
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FIGURE D6. OPERATIONAL SEQUENCE ANALYSIS FOR THE FUEL SYSTEM'S TANK IMBALANCE PROCEDURES 
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